FDA Spied On Emails To Try To Silence Critics

from the and-it-may-have-just-made-new-critics dept

We've discussed how the government often seems much more focused on silencing leaks of information, rather than recognizing that those leaks are often highlighting serious misconduct. The latest example involves the Food and Drug Administration (FDA), who apparently started trying to find the source of a leak, but in the end started collecting thousands of emails to try to stifle all sorts of criticism of the FDA, as revealed by the NY Times over the weekend.

What began as a narrow investigation into the possible leaking of confidential agency information by five scientists quickly grew in mid-2010 into a much broader campaign to counter outside critics of the agency’s medical review process, according to the cache of more than 80,000 pages of computer documents generated by the surveillance effort.

Moving to quell what one memorandum called the “collaboration” of the F.D.A.’s opponents, the surveillance operation identified 21 agency employees, Congressional officials, outside medical researchers and journalists thought to be working together to put out negative and “defamatory” information about the agency.

The details show that the FDA installed key logger software on the computers of their own scientists, tracked the personal emails they wrote to others, and tracked documents they copied to key drives. Now, you can make a reasonable argument that since these were work laptops, the FDA has every right to track the usage, but it seems pretty clear that the FDA went really far here, and it wasn't just about stopping leaks, but about trying to stifle criticism and whistleblowing.

In fact, much of the evidence suggests that this absolutely was an attempt to blow the whistle on faulty review procedures by the FDA, that resulted in the approval of medical imaging devices that weren't actually safe. And, apparently, the complaints by the whistleblowers were convincing enough that there's now a Congressional investigation into "a substantial and specific danger to public safety" from this activity.

If the FDA were functioning as it was supposed to, it would have seen these complaints as a reason to investigate its own activities. Instead, in the supposed attempt to "stop leaks," the FDA used this info to try to squelch the attempt to have its own practices investigated.

Re: Re:

Re:

Can someone show me that they monitored anything other than 'employer issued' laptops?

I read the NYTimes article and I don't see any mention of actually monitoring Congressional Aides, only that they monitored the emails the scientists sent *to* Congress. That's a far far different thing and since these laptops are issued by the gov't, the gov't has every right to monitor anything done with them.

Re: Re:

Just because they may or may not have the legal "right," should be less important than an agency of the U.S. Government using/abusing it's 'rights' to cover up failures that potentially put unsafe devices in people's bodies.

I'll take "natural and legal rights" of the citizenry to an accountable government and safe medicine.

Re:

We have to stop these treasonous leaks... if we do not continue to approve (for a nice fee) all these profitable (though potentially leathal) technologies we would lose 1000000000 jobs and suffer an incomprehensible loss to our economy of 1gigagillion dollars. And don't forget the rampant child porn that would be unleashed on our world.

I think I make a better troll because I can make up things and raise completely unrelated arguments.

Just part of their device testing protocol...

Maybe this was just the testing protocol for a new medical device. The device under test is called the "Cover Your Ass" (CYA) medical device. As it has failed the first round of testing, as evidenced by the continued flow of information regarding FDA wrongdoing, it will have to go back to another round of development. However it seems almost guaranteed that the replacement officials at the FDA will continue to support development of this device.

I believe they have all the right to monitor company notebook activities. Except that their rights do not encompass personal e-mail accounts. The right way to prevent ppl from using their e-mails in the workplace to send sensitive stuff out of the company controls is to block access to such material.

Re:

Incorrect, if you use their computer to access your personal account anything you do is fair game. You're using their device to do personal stuff and it's either against policy on that front, or they denote up front that they are allowed to monitor what you do with their device.

However, if the FDA logged the passwords and then *later* logged in to their email, that is not. But I don't see any mention of that in the NYT article.

Re: Re:

Monitor is ok, you can monitor what's done without logging passwords. Every1 has a banking life and most companies I know allow you to check your account from within the company network. So the question is, are they allowed to monitor your banking history and passwords? I don't think so, even if they don't plan to log into your account later.

Besides, if there's enough sensitive information you have to block all access to the internet because you wouldn't be able to see exactly what's going through an encrypted connection that easily (please correct me if I'm wrong). I don't see how they could see who were the ppl the employees sent their e-mails on external webmails without effectively logging into their accounts.

All the rest is fair game, including monitoring what files go into what usb sticks and that's something we know it's done regularly within the US Govt from Bradley Manning's case (again correct me if I'm mixing up something but they got to him by checking the files that were transferred to a usb stick with his login).

Re: Re: Re:

Monitor is ok, you can monitor what's done without logging passwords. Every1 has a banking life and most companies I know allow you to check your account from within the company network. So the question is, are they allowed to monitor your banking history and passwords? I don't think so, even if they don't plan to log into your account later.

The US government (USG) does have the right to monitor everything done on their computers and network because users may not log into a USG computer unless they agree to monitoring. All properly configured USG computers display a log-in warning banner that states the computer is an official USG computer to conduct USG business. The banner also states that there is no expectation of privacy, all activity is monitored, and by logging in the user consents to monitoring.

All USG employees and contractors are also required to complete annual FISSA training. A reminder that users consent to monitoring is also in that training. The USG also has an ROB that users must accept before they are allowed to use a USG computer, and guess what the ROB contains? That makes three notices warning of monitoring, one of which appears every time you log in.

The scientists only have a case if they were using a USG computer that did not have a warning banner, they never took FISSA training, and they did not sign an ROB.

Besides, if there's enough sensitive information you have to block all access to the internet because you wouldn't be able to see exactly what's going through an encrypted connection that easily (please correct me if I'm wrong).

All unsolicited SSL connection attempts from the Internet to USG computers are (well, are supposed to be) blocked. Outbound SSL connections are decrypted by the USG using a proxy similar to a man-in-the-middle attack.

I don't see how they could see who were the ppl the employees sent their e-mails on external webmails without effectively logging into their accounts.

Yahoo! webmail only encrypts authentication, everything else is sent in clear text which can be obtained through a network packet capture. I beleive GMail encrypts everything. Decryption of GMail is accomplished with a proxy as mentioned above.

well

why not just have the FDA approve all FDA-criticisms.
that way they can just 100% refuse all licenses without $100 million dollar bribes

OMG the heads of the FDA have been taking bribes all the way upto july 2012 to pass completely unsafe drugs that cause spontaneous abortions and aneuryms? and would cream their pants for this kind of power?

The thing about monitoring is, once it starts it gets out of hand very quickly. You find what people actually think of you, the jokes they tell about you. You find one person sending something that "Might" be a problem to another. You then look at this other person who leads you elsewhere.

Its why the monitoring of citizens will lead to more monitoring. Because when you know what people actually think of you, you begin thinking there is a conspiracy behind every door.

To be honest, the solution to this problem is not legal (make better laws that forbid such snooping), but providing proper end to end encryption (meaning, store the emails themselves encrypted) so such snooping simply cannot happen again.

To me it's rather simple: we tried playing nice relying on the relevant authorities to keep their hands of our privacy, they failed, it's time we take away all their control so they simply cannot abuse it.